Binance hack began with a $296 million XRP drain after 36-hour preparation

The Binance attacker spent at least 36 hours preparing for the $6.36 billion crypto exchange hack that began with $296 million in XRP.

According to an Oct. 29 investigation by TRM Labs, the attacker began preparing the operation on Oct. 28 before executing coordinated transfers across 10 blockchains the following evening.

The blockchain intelligence firm found that most of the funds left Binance-linked wallets within approximately 20 minutes, making the incident the largest cryptocurrency theft on record.

TRM traced the earliest preparations to the morning of Oct. 28, when an attacker-controlled wallet received three small transfers from Tornado Cash, a cryptocurrency mixing service.

Early the following day, the attacker deployed malicious smart-contract code and tested it against two newly created Ethereum wallets.

The attacker subsequently deployed a revised version and rehearsed the operation on a third wallet, successfully transferring test funds before returning them.

Approximately four hours after that final rehearsal, the main attack began.

Between 20:05 and 20:09 UTC, five Binance wallets on the XRP Ledger transferred approximately 233.46 million XRP, valued at $296 million, into a single attacker-controlled address.

On-chain investigator Wazz Crypto reached a similar conclusion, saying: